What is GHSA-3534-xp88-25rc?

GHSA-3534-xp88-25rc is a security advisory published by GitHub Security Advisories with High severity. Parse Dashboard is Missing CSRF Protection for its Agent Endpoint

Which CVE IDs does GHSA-3534-xp88-25rc cover?

GHSA-3534-xp88-25rc covers the following CVE IDs: CVE-2026-27609. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-3534-xp88-25rc?

GHSA-3534-xp88-25rc affects 1 product, including: npm/parse-dashboard:\u003e= 7.3.0-alpha.42, \u003c 9.0.0-alpha.8.

GHSA-3534-xp88-25rcHigh

Parse Dashboard is Missing CSRF Protection for its Agent Endpoint

Vendor

GitHub Security Advisories

Published

February 25, 2026

Last Modified

February 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-27609 →

📋 Description

Impact

The AI Agent API endpoint (POST /apps/:appId/agent) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session.

Patches

The fix adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page.

Workarounds

Remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected.

Resources

GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-3534-xp88-25rc
Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8

🎯 Affected products1

npm/parse-dashboard:>= 7.3.0-alpha.42, < 9.0.0-alpha.8